Phased Application
The EU AI Act was published in the Official Journal of the European Union on 12 July 2024 and entered into force on 1 August 2024. It applies in phases over three years:
Phase 1: February 2025 – Prohibited AI Practices
Status: Already in force since 2 February 2025.
Art. 5 EU AI Act prohibits the following AI practices:
- Social Scoring by public authorities – evaluating natural persons based on their social behaviour
- Subliminal Manipulation – AI techniques that unconsciously influence a person's behaviour
- Exploitation of Vulnerabilities – exploiting age, disability, or social/economic situation
- Real-time Remote Biometric Identification in publicly accessible spaces (with exceptions for law enforcement)
- Biometric Categorisation by sensitive attributes (ethnicity, political opinion, religion)
- Untargeted Scraping of facial images from the internet or CCTV footage
- Emotion Recognition in the workplace and educational institutions (with exceptions for safety/health)
Penalties: Up to €35 million or 7% of global annual turnover (Art. 99(3)).
Phase 2: August 2025 – GPAI Obligations and Governance
Status: From 2 August 2025
- GPAI Models (Art. 51–56) – transparency obligations for providers of general-purpose AI models
- GPAI with Systemic Risk – additional obligations: red teaming, model evaluation, incident reporting
- AI Literacy (Art. 4) – organisations must ensure that staff involved with AI are adequately trained
- Governance (Art. 64–68) – establishment of the European AI Office and national competent authorities
Phase 3: August 2026 – High-Risk AI Obligations (Main Deadline)
Status: From 2 August 2026 – approximately 5 months away
This is the most critical deadline for most organisations. From this date, all obligations apply to high-risk AI systems under Annex III:
- Risk Management System (Art. 9)
- Data Governance (Art. 10)
- Technical Documentation (Art. 11 + Annex IV) – Guide
- Record-Keeping (Art. 12)
- Transparency for Deployers (Art. 13)
- Human Oversight (Art. 14)
- FRIA (Art. 27) – Guide
- Conformity Assessment (Art. 43)
- EU Database Registration (Art. 49)
Penalties: Up to €15 million or 3% of global annual turnover (Art. 99(4)).
Phase 4: August 2027 – Embedded AI in Regulated Products
From 2 August 2027:
Obligations for AI systems embedded as safety components in already regulated products under Annex I (e.g. medical devices, machinery, toys, lifts, pressure equipment).
Timeline Overview
| Date | What Takes Effect | Article |
|---|---|---|
| 1 Aug 2024 | Regulation enters into force | Art. 113 |
| 2 Feb 2025 | Prohibited AI practices | Art. 5 |
| 2 Aug 2025 | GPAI, AI literacy, governance | Art. 4, 51–56, 64–68 |
| 2 Aug 2026 | High-risk AI (Annex III) | Art. 6–27, 43, 49 |
| 2 Aug 2027 | Embedded AI (Annex I products) | Art. 6(1) |
What You Should Do Now
- Create an inventory – which AI systems do you use? Which do you develop?
- Risk classification – use the free risk assessment to check whether your systems fall under Annex III
- Start documenting – begin your FRIA and technical documentation now – the August 2026 deadline is approaching faster than you think
- Build a compliance team – AI literacy (Art. 4) has been mandatory since August 2025